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Dear Readers, 

And here it comes - the edition on Mobile Hacking. In 
this issue we will focus on hacking/security matters of 
those tiny computers everyone has with him or her almost 
everywhere and most of the time. 

When it comes to an ordinary PC or laptop safety it is 
no wonder to anybody that such devices should be pro- 
tected against viruses, hackers and all potential threats. 
But in their everyday life people tend to forget about pos- 
sessing a little computer that is used for calling, texting, 
sending e-mails, surfing on the Net, working and whatever 
other stuff they do on their mobiles. They can be hacked 
too, so it is well worth finding out how, and how to coun- 
teract. 

So let's start with the Attack section and the article 'Mo- 
bile Phone Spying, Detection and Countermeasures' pro- 
viding fine examples of these. The other article in this sec- 
tion deals with Sim Card Hacking. Then from the Defense 
section you will learn about the Windows Phone 8 security 
features and pentesting, and also what can be mobile net- 
work traffic analysis used for. Because many of our target 
readers have their families and children, they will definitely 
benefit from the article 'Mobile Kids Safety' written by the 
specialist involved in Online Child Safety program, who is 
also interviewed in this issue. In our Extra section there 
is somewhat controversial paper titled When is a Tablet 
safer than PC?' So let's find out the author's answer and 
check if you agree... 



Hakin9's Editorial Team would like to give special 
thanks to the authors, betatesters and proofreaders. 

We hope our effort was worthwhile and you will find the 
Hakin9 Mobile Hacking issue appealing to you. We wish 
you a nice read. 



Julia Adamczewska 
and the Hakin9 team 
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By Akin fe Oluwafemi, CCNA, CCNA sec, A+ IT Tech, 
C\EH, E\CSA- Information Technology 

Too many people see their portable PC which the smart- 
phone today certainly is still as a phone with a sense of 
phony security accordingly. Thus mobile security pru- 
ducts use is still in it's infancy when you compare it with 
the classic PC/Laptop. 



Sim Card Hacking 
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by Anupam Sharma 

SIM cards were believed to be the most secure 
part of a mobile phone but recent researches have 
proved otherwise. An expert cryptographer with- 
in security research labs has found a way to trick 
mobile phones into granting access to the device's 
locations, SMS functions, and allow changes to a 
person's voicemail number. 

DEFENSE 

Windows Phone 8 Application 
Penetration Testing Essentials 18 

By Wouter Veugelen, Cyber Security Consultant, 
member of AISA, ISACA, ISSA 

An overview of the Windows Phone 8 operating system 
security features and how to conduct penetration tests 
of Windows Phone 8 applications. 
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By Milad Hosseni, Application Security Specialist, the 
founder ofAustation.com 

Mobile network analysis is the process of capturing net- 
work traffic and inspecting it closely to determine what 
is happening "under the hood". Monitoring network traf- 
fics is important in most mobile app penetration testing, 
yet fun to mess around with. 
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by Dalibor Vlaho, OSCP, CEH, CEO at Information 
Security Agency 

The article on how to protect your family and mostly th 
youngsters against serious hacking dangers and how 1 
control them using various applications. The overvie[ 
written by the specialist deeply involved in the Onli 
Child Safety Education and Abuse-Prevention Progra 

PLUS 

When is a Tablet safer than PC? 3 

by Farzad 'Fernando' Ghafourian, Security Specialist,, J 
Technical Sales Engineer at Eset Australia 

It is said that tablets and smartphones are not enough 
smart in security and since vulnerabilities rely or^l 
curity stupidity", it is judged that these new born J 
ances are not safe to use. The judgment has becc 
so bold that recently some organizations preferred, 
to use smartphones and tablets. The question i j 
laptops always safer than smartphones and tablets?" 
The answer is... 
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Interview with Akinfe Oluwafemi 

by Julia Adamczewska 
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Mobile Phone Spying, 
Detection and 
Countermeasures 

Mobile Security have been a much discussed field in IT security 
due to the wide spread use of mobile devices. This article 
aims at exposing Mobile Phone Spying (or Track and Trace), 
how it's done with reference to concept and available tools, 
Detection and Countermeasures, It presents Mobile Spying in 
its real offensive light so that IT security professionals can put in 
proactive measures to combat this threat 



Over the past two decades, improvements 
in engineering (both software and hard- 
ware) in the mobile computing space has 
given birth to high end mobile devices having ca- 
pabilities of PCs. Initially limited to voice commu- 
nication, mobile phones have become smarter and 
smarter. Higher processing speed, larger screens, 
touch input features, wireless facility and GPS loca- 
tion awareness have paved the way for even more 
improvements in deployable custom and third party 
mobile Apps. The proliferation of software and the 
advancement in Engineering have increased the at- 
tack space for mobile devices over the years- rang- 
ing from simple to more advanced attacks. Despite 
this, mobile devices form the fastest growing con- 
sumer technology with worldwide sales exceeding 
650 million in 2012 alone with brands like Apple's 
iPhone enjoying "Super" patronage. Human life 
tends to revolve around the mobile phones. 

In addition to their use for conventional services 
like Voice communication and Web surfing, mo- 
bile devices now store tremendous amounts of fi- 
nancial, personal and commercial data that is juicy 
enough to attract both targeted and mass-scale at- 
tacks. Over the years, we have seen various at- 
tacks been launched at mobile devices; some OS 
independent while others are device dependent. 
Threats like Viruses, Worms, Trojans and single 
target spying applications have gained ground; 



Buffer overflow (iOS about 2007), SMS fuzzing 
(iOS 2009), Application Permission escalation (An- 
droid 2010), OS rootkit (Android 2010). Though 
compared to their PC counterpart we are yet to 
see threats like rootkit (except on Android devices 
in 2010), distributed spyware and self-propagating 
worms - worms availability requires user interac- 
tion to propagate. New Threats are growing at 42% 
yearly though. We can't stop here without mention- 
ing mobile phone and tablets theft. 

Of all the attacks launched at mobile devices 
(Smart Phones and Tablets) the most common is 
"Mobile Phone Spying" for obvious reasons. One 
is the ease at which this can be done (availability 
of tools and the low technical know-how needed to 
execute an attack) and the motivation for such ac- 
tion ranging from emotional to financial or simply 
for outright damage as a phone wipe can be ex- 
ecuted remotely with relative ease. 

Mobile Phone Spying 
The Concept 

A spy attack to mobile phone varies in concepts and 
means, but there seems to be a common factor un- 
derlying most methods. The most common is the 
use of a client -server like concept unlike bluejacking 
which is a client - client concept. An intrusive appli- 
cation is installed on the mobile device which in turn 
communicates to a remote server through an internet 
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connection sending details such as SMS, call logs, 
phone books, GPS location, browser history, cam- 
era pictures, voice call recording, available applica- 
tions etc. to the remote server. Keylogging can also 
be implemented. The attacker then logs into a web 
interface over the internet to view all retrieved infor- 
mation from the user or the application sends SMS 
messages to the attacker. The application works by 
hooking all messaging API and also reads contents 
of application data files. This appears to be viable 
for organizations trying to enforce policies or moni- 
tor staff, but it can also mean the ability for a black- 
hat eavesdropping on important information which 
can be used for further attacks. The situation can 
become worse if local data storage is insecure (en- 
cryption, caching of information not intended for long 
term storage) and poor authorization and authenti- 
cation schemes lead to privilege access issues. 

The spy application is installed on the victim's 
mobile device like any other mobile application af- 
ter which it hides itself by running as a process in 
the background. It will not be visible in the applica- 
tions' task list, user interface or application manag- 
er. All local logs of information sent over the inter- 
net to the attacker are erased as soon as the spy 
message have been sent - making it uneasy to de- 
tect the presence of the spying application. Most of 
these applications are available for free in the wild 
and for sale off-the-shelf and over the internet. It 
should be noted that legit mobile applications can 
also be "trojanised" with Spyware. 

Spying Tools 

There are so many tools available such that I can't 
mention all of them in this write up. Few that stand 
out are Neo-Call spy, Mspy, FlexiSpy, Stealthge- 
nie, Cell phone Spy and Mobile spy. I'll give brief 
feature list of the tools below: 

Neo-Call Spy 

Initially created to spy on Symbian phones, its fea- 
tures have now been extended to cover iPhone, 
Blackberry, Android and Windows Phones. It sends 
information directly to another mobile phone. The 
software is based on the IMEI number -this means 
that the attacker must know the target. It offers the 
following spying features SMS, Call List, Location, 
Remote Listening, Key logging, It is also covert in 
operation. Commands are sent from the Master 
phone to the Target to obtain information from the 
target through hidden SMS messages. 

Mspy 

It runs on Smart Phones and Tablets. It allows you 
to spy on calls, SMS messages, Emails, GPS lo- 
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cation, browsing history, calendar, address books, 
IM Messages, Record Surroundings, Control In- 
stalled Apps and programs, view Multimedia files, 
remote control features including device wipe and 
excellent reporting feature. It's covert in operation 
and uses the Client - server behaviour with a web 
based front end. You can view all the spied infor- 
mation online through a secured online account. 

FlexiSpy 

This was initially classified as a mobile device tro- 
jan due to its invasive nature but later the classifi- 
cation reduced as variants were released. It helps 
spy on mobile phones and tablets. It offers about 
1 30 features which when categorized fall within the 
coverage of Mspy. Additional features like camera 
spying and Wallpaper viewing are invaluable to an 
attacker. It's also covert in operation and can often 
go undetected. This also uses a Client - Server 
architecture with a web based front-end. You can 
view all the spied information online through a se- 
cure online account. 

Stealthgenie 

This is also operated covertly and works similarly 
to FlexiSpy and Mspy - with the same feature set. 

Mobile Spy 

This has most of FlexiSpy's features set with addi- 
tional Application Blocking, remote Install abilities 
and live control panel abilities. Multimedia files can 
be downloaded from the front end panel. 

Other tools are (Source: http://cell-phone-moni- 
toring-software-review. toptenreviews. com/): 

HIGHSTER MOBILE 

An easy-to-use cell phone monitoring software; 
Text messages, call recordings, call logs... all sent 
from the target phone right to the user email, cell 
phone of online web account immediately. 

All-in-one Spy Software 

Top quality spy phone software since 2006. Cell 
phone tracking & surveillance. Secure SMS. Voice 
Encryption and PC monitoring software. 

Easy Spy 

Easy-to-use program for monitoring cell phones. 
Provides instant access to text messages, calls 
and more. Right from the user own cell phone, 
computer or tablet, undetected. 

Spybubble 

Powerful yet covert cell-phone monitoring software 
that tracks and aecords all information in real-time. 



It is wel-known cell phone monitoring and tracking 
system with call listening and environment listening. 

MobShield (Mobile Shield) 

Highly advanced cell phone application that allows 
the user to restrict the use of the cell phone while 
monitoring the phone's activities. MobShield is the 
best way to protect your kids, aged parents, spouse, 
or employees from danger and temptation. 

Phone Spy 

Monitoring conversations of a spouse, lovers, chil- 
dren, employees and anybody else that the user 
chooses. Once the phone makes connection with 
the target phone, its user can start listening to what 
is happening around the target phone. 

MobileSpy 

The next generation of smartphone spy software. 
Silently monitoring text messages, GPS locations, 
call details, photos and social media activity; view- 
ing the screen and location live. 

Spyera 

The software that is installed on a smart phone 
to monitor everything happening on the phone. 
SPYERA secretly records events (sms, call his- 
tory, phone book, location, emails, What's App 
messages, IM, Facebook Chat, Skype, see pho- 
tos taken and many more...) that happen on the 
phone and delivers these information to a web 
account, where the user can view these reports 
24/7 from any Internet enabled computer or mo- 
bile phone. 

OX for Android MobileSpy 

Cell phone spy for smart Android version phone 
also provides users a free trial process, it can be 
download to the mobile phone to learn what the 
children are secretly talking and texting, smok- 
ing, drugs, or what the employees are really doing 
away from office with this mobile spy. 

VspyMe 

Are you are spending sleepless nights worrying 
about where your kids are or what they are up to? 
Look no further. vSpyMe Children and family is a 
powerful cell phone spy software designed to ease 
your burden and give you better visibility, transpar- 
ency and control of what's going on in your home 
and the lives of people you care about. 

MerrySpy 

A spy software to turn ordinary Nokia S60 phones 
into spy phones. 
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Mobile Phone Spying, Detection and Countermeasures 



SpyMaster Pro 

World's most efficient and advanced cell spying 
software, works 100% in hidden mode without 
leaving any indication of detection. 

EasilySpy 

100% Safe and easy to use, yet powerful enough 
to get the needed information. 

PhoneSheriff 

The next generation of parental control software for 
mobile phones and tablets. If you are worried that 
your children are using their phones and tablets in- 
appropriately, then use PhoneSheriff (Figure 1-4). 

Case Study 

Todd's suddenly sounds all religious and stuff. He 
claims to live righteously and proves that others 
are not as good as him. Edwin hates this and be- 
ing a blackhat, he wants to prove otherwise to him 
and his mates, that Todd is not a saint after all. 
He starts looking for ways to provide evidence that 
that's not the case. Appropriate tool: Mobile Spy, 
FlexiSpy and Mspy. Method: 

• Edwin opens an account with any of the three tools. 

• He downloads the application, "Trojanises" it 
with a gaming application or just transfers it to 
Todd's phone through Bluetooth since he has 
access to the phone. 

• He installs the application, logs on to the por- 
tal online. Monitors the phone for porn and illic- 
it pictures, downloads it and presents it to Todd 
and his friends. What an embarrassment for 
Todd... and a good lesson learnt. 

These tools though having a legal ground for us- 
age are potential black hat delight since informa- 
tion gathered from the phone can be used for ma- 
licious purposes. Care must be taken to under- 
stand the way Mobile phone Spying works and 
how to Detect and/or prevent this imminent threat. 

Detection 

Like in any other investigation, careful attention is 
paid to some basic phone behavior like increased 
data charge due to usage, strange behavior of the 
phone like sudden phone reboot, flashing screen, 
locked down applications. 

Analysis of the compromised phone can be cat- 
egorized into three: 

• Traffic analysis 

• Process Analysis 

• File System Analysis 



Traffic analysis 

Most spy tools communicate with the attacker through 
SMS, MMS or over the data channel. So even if the 
tool is able to evade the user, it can't bypass the op- 
erator's billing system. Most of the time, phone users 
are on a monthly Data and SMS plan making it even 
more difficult to detect. In this senerio an investigation 
SIM is used (A SIM that is not used for any other pur- 
pose obtained from the mobile phone operator). The 
SIM is installed in the phone and up to 10 or more 
SMS are sent to the phone. - This of course should 
be free to the phone's user, so if there are charges, 
then the phone is likely a victim of phone spying. Sim- 
ilarly, disable all automatic update feature and ob- 
serve the GPRS/EDGE icon after an SMS is sent. 
Check the data bill again and very unusual then this is 
a call to be suspicious. The TCP/IP traffic can also be 
sniffed using Wireshark, a PC, Wireless Router (Pro- 




Figure 1 . Front End: SMS captured using Mobile Spy 




Figure 2. Front End: Photos Captured using Mobile Spy 




Figure 3. Front End: Stealth Camera 
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Figure 4. Front End: GPS Location 
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visioned for internet Access) and Switch - do this at 
your own risk as this is illegal in some countries. I will 
not give details here. Sorry. Some spying tools insist 
on the use of the Phone's Data instead of WLAN, they 
tend to create their own form of access visible on the 
phone after connection to WLAN - this is a clear indi- 
cation of Mobile Spying application's presence on the 
phone. An example is FlexiSpy (Figure 5). 
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Process Analysis 

Get another Phone, list out all processes running 
on that phone. Access the process List of the sus- 
pected phone and list them out. Compare the two 
lists for any suspicious processes. For any pro- 
cess that is suspected not to be an OS process or 
a legitimate application process further investiga- 
tion should be done on that process. This analysis 
is based on that fact that most Spy tools do not 
hide their processes. For Windows mobile the reg- 
istry is the best place to search for anomalies. 

File System Analysis 

Compare the file system of the phone to another 
phone which is clean. It is advisable to install a file 
monitor application to monitor processes accessing 
the file system when receiving and sending SMS, 
MMS, incoming and outgoing calls or emails. F-ex- 
plorer, EzFileMon are applications that can be used 
for Symbian Phones. Once the process is found, kill 
it and see if any spying continues. After this, try to 
locate the file and delete it. Check the location of 
installed applications. Any application that is not in- 
stalled within the right path is a suspect. 

Prevention / Countermeasures 

• Do not jailbreak or root your phone iPhone or 
Android phones respectively - this removes 
most of the security features on the phone - 
Charlie Miller, SyScan 2009. 
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Figure 5. Monitored traffic from a Mobile Spy infected Phone 
(Jarno Niemela) 



• Use a good mobile antivirus - This detects 
commonly used spy tools. This is one of the 
sure protection against Mobile Device spying. 

• Set access security on the Phone e.g password 
lock, pattern lock etc. This will help reduce the 
possibility of an attacker gaining access for in- 
stallation of the application on your phone. 

• Update you Mobile OS - Keep you Mobile OS 
updated. Security Patches are released with 
OS upgrades and updates. 

• If possible implement an OS re-installation pol- 
icy in your organization. - this will ensure that 
undetected compromised phones are corrected. 

• During crucial meetings, power down you phone 
- an attacker may have gained access to the 
camera and may be doing surround recording. 

• Keep your phone close to yourself at all times. 

• Install only signed application - this is the on- 
ly sure way to prevent "trojanised" applications 
from being installed. 

Mobile phone spying applications are easy to get 
in the wild. This has dramatically increased the 
occurrence of spying and its consequences. Mo- 
bile phones are gradually taking over from PCs 
as people are being drawn because of the feature 
rich yet portable nature of mobile devices. Spying 
remains one of the major threats in the industry 
and should be given careful attention within the 
security space. 

AKINFE OLUWAFEMI G 

9/s the President of Iris Computer Solu- 
tions, which specializes in the provi- 
sion of various IT services ranging from 
Wmi^ Networking and Security to Software 
I development. He has over 10 years of 
| practical IT experience and holds a de- 
gree from the prestigious Federal Uni- 
versity of Technology, Akure. He has 5 certifications; 
CCNA, CCNA Security, CEH, ECS A andA+ IT Technician. He 
has a passion for innovation in the Networking and Net- 
work Security Space. He is also an IT infrastructure sup- 
port Professional. He can be found online at the follow- 
ing sites: http://www.iriscomputersolutions.com/ and 
http://247infotech.wordpress.com/. 
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Facebook: facebook.com/lriscomputers 
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ATTACK 

SIM Card Hacking 




SIM cards were believed to be 
the most secure part of a mobile 
phone but recent researches 
have proved otherwise. An expert 
cryptographer within security 
research labs has found a way to 
trick mobile phones into granting 
access to the device's locations, 
SMS functions, and allow changes 
to a person's voicemail number. 



SIM (Subscriber Identification Module) is a 
small card inserted into a device that ties it 
to a phone number and authenticates soft- 
ware updates and commands. There are more 
than 7 billion SIM cards are in use worldwide. To 
ensure privacy and security, SIM cards use en- 
cryption when communicating with an operator, 
but the encryption standards used vary widely. 



Recent studies have shown that just under a 
quarter of all the SIM cards that were tested, 
could be hacked. Given that encryption standards 
vary widely between countries, it has been es- 
timated that an eighth of the world's SIM cards 
could be vulnerable, or about half a billion mobile 
devices (Figure 1 ). The SIM card hacking flaw was 
discovered by German programmer Karsten Nohl, 





Clock 



Figure 1 . Smart Chip in a card 
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who has informed mobile operators of the potential 
danger. After that all, the Mobile phone users have 
been put on an alert that their SIM cards can be 
hacked anytime which may lead to fraud and soar- 
ing premium rate bills. 

On the other hand, if we talk about the mobile op- 
erators they say that they are already aware about 
this flaw and are taking steps to patch the flaw be- 
fore customers are hit. 

Worldwide, mobile phones are the major source 
used in accessing online banking and other sensi- 
tive personal information. If the discovered flaw is 
used by Hackers, it may lead to a privacy disaster. 
This flaw also makes some noise for the mobile 
customers who use their Smartphone's to pay bills 
and transfer money. 

Flaw Researcher (Karsten Nohl) says something 
about his Flaw: 

"Give me any phone number and there is some 
chance I will, a few minutes later, be able to re- 
motely control this SIM card and even make a co- 
py of it," 

However, the international umbrella mobile opera- 
tor organization, the GSMA, said that the flaw was 
limited to a minority of SIM cards and that newer 
SIM cards may not be affected. It said that it had ad- 
vised operators of the security risks involved. 

Major Causes of SIM Card Hacking 

See Figure 2. 

Outdated Encryption Standard 

Researchers have indicated that many SI Ms use 
a weak encryption standard dating from the 1970s 
called DES (Data Encryption Standard). DES has 




Active Chip Side 
Chip 



long been considered a weak form of encryp- 
tion, and many mobile operators have upgraded 
to more secure Encryption. It is relatively easy to 
discover the private key used to sign content en- 
crypted with DES. 

Cracking SIM Update Keys 

OTA commands, such as software updates, are 
cryptographically-secured SMS messages deliv- 
ered directly to the SIM. While the option exists 
to use state-of-the-art AES or the somewhat out- 
dated 3DES algorithm for OTA, many (if not most) 
SIM cards still rely on the 70s-era DES cipher. DES 
keys were shown to be crackable within days us- 
ing FPGA clusters, but they can also be recovered 
much faster by leveraging rainbow tables similar 
to those that made GSM's A5/1 cipher breakable 
by anyone [1]. 

In an experiment conducted at the Security Re- 
search Labs, researchers sent a binary code over 
SMS to a device using a SIM with DES. Since 
the binary code wasn't properly cryptographically 
signed, it would not run on the device. 

But while rejecting the code, the phone's SIM 
makes a crucial mistake: it sends back over SMS 
an error code that carries its own encrypted 56- 
bit private key, according to the company. Because 
DES is considered a very weak form of encryption, 
it's possible to decrypt the private key using known 
cracking techniques. 

Security Research Labs did it in about two min- 
utes on a regular computer with the help of a rain- 
bow table, a mathematical chart that helps convert 
an encrypted private key or password hash into its 
original form faster. 

Chip Adhesive 

Metal Contacts 




i Encapsulation 
Card Body Substrate 



Hotmelt 



Bond Wire 



Figure 2. How a Sim card is read 
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With the private DES key in hand, it is then pos- 
sible to "sign" malicious software updates with the 
key, and send those updates to the device. The de- 
vice believes the software comes from a legitimate 
source and then grants access to sensitive data. 

Using the SIM's private key, an attacker could 
force the SIM to download Java applets, which 
are essentially very small programs that perform 
some function. Those applets would be "allowed to 
send SMS, change voicemail numbers, and query 
the phone location, among many other predefined 
functions." 

With the all-important (and till-now elusive) en- 
cryption key, it is even possible to send a virus to 
the SIM card, which could then send premium text 
messages, collect location data, make premium 
calls or re-route calls. A malicious hacker could 
eavesdrop on calls, albeit with the SIM owner prob- 
ably noticing some suspiciously-slow connections. 

The company outlined an attack scenario against 
SIM cards that run some form of Java virtual ma- 
chine, a software framework for Java applications. 



Java Sandboxing 

A second bug has also been found. Unrelated to 
the weak encryption key, it allows even deeper 
hacking on SIMS and is caused by mistake on the 
part of SIM card manufacturers. In principle, the 
Java virtual machine should assure that each Java 
applet only accesses the predefined interfaces. 

Key to the hack is Java Card (2), a general pur- 
pose programming language used on 6 billion SIM 
cards. If operators need to update something on 
your SIM, for instance allowing interoperability with 
a carrier in another country, it will execute the right 
Java Card programs on your SIM by sending your 
mobile a binary SMS (Figure 3). 

Java Card uses a concept called sandboxing, in 
which pre-installed programs like a Visa or PayPal 
app are shielded from one another and the rest of 
the SIM card. The term comes from the idea of on- 
ly allowing programs to "play with their own toys, in 
their own sandbox," "This sandboxing mechanism 
is broken in the most widely-used SIM cards." The 
researcher said he found a few instances where 
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import javacard . framework . * 

public class My Applet extends Applet { 

// Definitions of APDU-r elated instruction codes 

MyApplet ( ) {. // Constructor 

// Life-cycle methods 

install {) {. . .} 

select {) { . . . } 

deselect () (...) 

process 0 { ■ ■ ■} 

// Private methods 
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Source; Introduction to Java Card Technology by C. Enrique Ortiz 



© 2009 C. Enrique Qrttz- httpJfCEnriqueQrtizxom 



Figure 3. Java Card Technology 
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the protocols on the SIM card allowed the virus he 
had sent to a SIM, to check the files of a payment 
app that was also installed on the card. 

In sum, a malicious hacker who wanted to use 
this method might start with a list of 100 phones. 
They could send a binary SMS to all of them, using 
a programmable cell phone connected to a com- 
puter. They might get 25 responses with crypto- 
graphic signatures, and dismiss the half that uses 
a stronger security standard. From the rest, Nohl 
surmises they could crack the encryption key of 
perhaps 13 SIM cards, and send them a virus 
that breaks through the Java Card sandbox barri- 
ers and reads payment app details, as well as the 
master key of the SIM card. 

Who Is To Be Blamed? 

Gemalto which made about half [3] its $2.5 billion rev- 
enue [4] in 2012 selling SIM cards, said in an email 
to Forbes that its SI Ms were consistent with state-of- 
the-art and applicable security guidelines, and that it 
had been working closely with GSMA and other in- 
dustry bodies to look into the earlier research. 

Despite this, it is believed that badly-configured 
Java Card sandboxing "affects every operator who 



uses cards from two main vendors," including car- 
riers like AT&T and Verizon who use robust encryp- 
tion standards. Are SIM cards with these 3DES 
standards vulnerable? Some people suggest they 
might be but are still unsure about the details. 

iPhone, Android, BlackBerry 

The mobile industry has spent several decades 
defining common identification and security stan- 
dards for SIMs to protect data for mobile payment 
systems and credit card numbers. SIMs are also 
capable of running apps. 

Nohl said Security Research Labs found mobile 
operators in many countries whose phones were 
vulnerable, but declined to identify them. 

All types of phones are vulnerable, including 
iPhones from Apple Inc, phones that run Google 
Inc's Android software and BlackBerry Ltd Smart- 
phone's, he said. 

BlackBerry's director of security response and 
threat analysis, Adrian Stone, said in a statement 
that his company proposed new SIM card stan- 
dards last year to protect against the types of at- 
tacks described by Nohl, which the GSMA has ad- 
opted and advised members to implement 
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Figure 4. Sim Card Hacking In Reverse 
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"We understand the vulnerability and are working 
on it," said CTIAVice President John Marinho. "This 
is not what hackers are focused on. This does not 
seem to be something they are exploiting." 

SIM Card Hack Could Affect Millions 
Worldwide! 

A United Nations group that advises nations on cy- 
ber-security plans to send out an alert about sig- 
nificant vulnerabilities in mobile phone technology 
that could potentially enable hackers to remotely 
attack at least half a billion phones (Figure 4). 

The bug discovered by German firm, allows 
hackers to remotely gain control of and also clone 
certain mobile SIM cards. 

Hackers could use compromised SIMs to com- 
mit financial crimes or engage in electronic espi- 
onage, according to Berlin's Security Research 
Labs, which will describe the vulnerabilities at the 
Black Hat hacking conference that opens in Las 
Vegas on July 31. 

The U.N.'s Geneva-based International Tele- 
communications Union, which has reviewed the 
research, described it as "hugely significant." 

"These findings show us where we could be 
heading in terms of cyber-security risks," ITU Sec- 
retary General Hamadoun Toure told Reuters. 

A spokeswoman for the GSMA, which represents 
nearly 800 mobile operators worldwide, said it also 
reviewed the research. 

"We have been able to consider the implications 
and provide guidance to those network operators 
and SIM vendors that may be impacted," said GS- 
MA spokeswoman Claire Cranton. 

Nicole Smith, a spokeswoman for Gemalto NV, 
the world's biggest maker of SIM cards, said her 
company supported GSMA's response. 

"Our policy is to refrain from commenting on de- 
tails relating to our customers' operations," she said. 

SIM Card Hack - Severe Implications for 
Business 

The impact of hacked SIM cards, one of the few 
stalwarts in the high-tech industry that has not 
seen a serious exploit, could be monumental. 

For individuals, the risk of someone hijacking 
your phone and listening in on calls or making pho- 
ny purchases is bad enough. For business users, 
these problems may soon be compounded consid- 
erably (Figure 5). 

As business data continues to move from the 
desktop PC to mobile devices, even rank-and-file 
employees are finding themselves walking around 
with a mountain of sensitive data in their pocket or 
purse. Lost and stolen phones have become an 



epidemic [5] for the corporate world, and solutions 
to this dilemma have been unbearably slow in pre- 
senting themselves. Compound that with the risk 
that a large number of business devices may also 
be able to be attacked via a remote exploit and cell 
phones are looking increasingly like the weak link 
in any business's infrastructure. 

Let's say a business does take steps to secure 
its handsets and ensure that SIM cards are proper- 
ly patched and safe from attack. What then? Even 
if businesses correct company-owned devices, 
plenty of risks are sure to remain, thanks to the 
rise of BYOD (bring your own device) programs. 
BYOD, for the uninitiated, is the policy of allow- 
ing employees to use their own phone or tablet 
for work - often in lieu of issuing them a compa- 
ny-owned mobile phone or even a landline. This 
saves the company money but remains a serious 
security risk - doubly so given the current news, 
since BYOD devices can't be easily patched or 
protected from a central location. 

Finally, as phone-based commerce becomes in- 
creasingly popular, this opens up yet another av- 
enue where businesses will face risks. Hackers 
could theoretically redirect payments or change 
the amounts involved, potentially leaving mer- 
chants high and dry at the end of a transaction. 

Remedies 

The risk of remote SIM exploitation can be reduced 
by the following measures: 

Improved SIM cards 

Cards need to use state-of-art cryptography with 
sufficiently long keys, should not disclose signed 
plaintexts to attackers, and must implement secure 
Java virtual machines. While some cards already 
come close to this objective, the years needed to 
replace vulnerable legacy cards warrant supple- 
mentary defenses. 




Figure 5. Hacked 3G 
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SMS firewall 

One additional protection layer could be anchored 
in handsets: Each user should be allowed to decide 
which sources of binary SMS to trust and which others 
to discard. An SMS firewall on the phone would also 
address other abuse scenarios including "silent SMS." 

SMS filtering 

Remote attackers rely on mobile networks to de- 
liver binary SMS to and from victim phones. Such 
SMS should only be allowed from a few known 
sources, but most networks have not implement- 
ed such filtering yet. "Home routing" is furthermore 
needed to increase the protection coverage to 
customers when roaming. This would also provide 
long-requested protection from remote tracking [6]. 



To sum up, the carriers should upgrade to newer 
encryptions quickly, not just for the safety of their 
subscribers, but future revenue too. Payment pro- 
viders like MasterCard and Visa will need to use the 
OTA protocol to fill SIM cards with Java applications, 
like credit card applets, and enable NFC-based pay- 
ments on phones in the future - and they'll pay car- 
riers for the privilege of being on the SIM. 

To conclude, SIM card hacking also projects a se- 
rious threat for mobile phones and therefore it must 
not be taken for granted and necessary measures 
and counter techniques need to be encouraged. 

ANUPAMSHARMA 

Sharma Lives in Shimla, Himachal 
Pradesh, co-founder of Aorso Technol- 
ogies and Unhacks Inc. He previous- 
ly served at Demagogue as a director of 
Network and Security for 1 year. He is 
Certified Ethical Hacker (CEH), Licensed 
Penetration Tester (LPT), Certified Hack- 
ing Forensics Investigator (CHFI) from EC Council Universi- 
ty California, USA. From long time he have been into secu- 
rity research and tracking tactics of hackers and intruders. 
He is currently working network checkpoint software which 
is to be launched in upcoming year. His main interest are in 
Mobile hacking and web application pentration testing. 






Workbooks.com 



Web Based CRM & Business Applications for 
small and medium sized businesses 



Find out how Workbooks CRM 
can help you 

- Increase Sales 

- Generate more Leads 

- Increase Conversion Rates 

- Maximise your Marketing ROI 

- Improve Customer Retention 

Contact Us to Find Out More 

+44[0) 118 3030 100 
infof9workbooks.com 




Windows Phone 8 
Application Penetration 
Testing Essentials 

This article will provide an overview of the Windows Phone 
8 operating system security features and how to conduct 
penetration tests of Windows Phone 8 applications. 



Android and iOS are the market leaders 
in terms of mobile platforms and mobile 
applications. Microsoft is hoping to gain 
more market share again with their latest mo- 
bile operating system. Microsoft's mobile oper- 
ating system Windows Phone, previously known 
as Windows Mobile, overtook Blackberry in mar- 
ket share in February 2013 [1] and IDC analysts 
predicted that by 2016 Microsoft's mobile operat- 
ing system will gain a market share of more than 
10% [2]. As a result, organisations are develop- 
ing more applications for Microsoft's mobile plat- 
forms; as such, IT security professionals should 
understand how these applications can be as- 
sessed and secured. 

This article will provide an overview on Windows 
Phone 8 security and will outline how to perform 
security assessments of Windows Phone 8 appli- 
cations. 

Windows Phone, Windows RT and 
Windows 8 

Microsoft introduced a new Application Program- 
ming Interface (API) called WinRT in its latest op- 
erating systems in addition the Win32 API that was 
supported in Windows operating systems since 
Windows 95. Applications developed using the 
WinRT API are known as Windows Store applica- 
tions, or Metro-style applications. 



Windows RT, Microsoft's operating system 
launched to support devices with ARM chipsets, 
only supports the WinRT API and is, by default [4, 
5], not able to run Win32 applications. 

Windows Phone 8 supports the Windows Phone 
RT API, which is only a subset of the WinRT API. 

Microsoft changed the kernel of the Windows 
Phone platform from Windows CE in Windows 
Phone 7 to Windows NT in Windows Phone 
8. This allowed Microsoft to inherit the secu- 
rity controls we are familiar with from modern 
Windows desktop operating systems to their 
mobile platform. 

Table 1 . Overview of Microsoft's latest operating systems 
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Windows Phone 8 

As a result of adopting the Windows NT ker- 
nel, Windows Phone 8 inherited key security 
features that were missing from prior Microsoft 
mobile platforms: 
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• NTFS file system support 

• BitLocker device encryption 

• Sandboxed applications: Applications run in 
their own sandboxed virtual environment 

• UEFI Secure boot: Unified Extensible Firm- 
ware Interface (UEFI) is the successor to the 
legacy BIOS firmware interface. UEFI relies on 
the Trusted Platform Module (TPM) 2.0 stan- 
dard requiring unique keys to be burned into 
the chip during production to restrict software 
without correct digital signature to execute. 

• All Windows Phone 8 binaries must have digi- 
tal signatures signed by Microsoft to run 

The older Windows Phone 7 operating system 
was built on the Windows CE kernel and did not 
have the above security features and as such, un- 
locking and running arbitrary ROM's and appli- 
cations was much easier. Windows Phone 8 ap- 
plications are downloaded through a central app 
store Windows Phone Store. 

Preparing your test environment 

Mobile application penetration tests can be con- 
ducted in 2 ways: using a physical Windows Phone 
8 device, or using emulators. Some of the prereq- 
uisites before you can start assessing your Win- 
dows Phone 8 applications are outlined next. 

Using a physical Windows Phone 8 mobile phone 

When using a physical phone an unlocked phone 
is required. At this stage, unlocking your phone 
can only be accomplished by either: 



• Registering a developer account and develop- 
er-unlock your phone for $99/year. On a devel- 
oper unlocked phone you can install up to ten 
applications that are not digitally signed by Mi- 
crosoft 

• Registering a student account: Students can 
install up to three applications that are not digi- 
tally signed by Microsoft 

• Register a company trusted certificate for En- 
terprise app stores for $399/year 

It is likely in the future it may become possible to 
unlock Windows Phone 8 devices using different 
means. For Windows RT, a jailbreak tool was re- 
leased [4] that disables code signing in the op- 
erating system's boot loader and allows the exe- 
cution of arbitrary applications. From preliminary 
analysis of the boot loaders of Windows 8, Win- 
dows RT and Windows Phone 8, they appear 
identical (Figure 1). 

There are some other limitations that make it 
more difficult, but not impossible for this to hap- 
pen in the future [3]. 

Using an emulator 

To test applications using emulators, the Windows 
Phone SDK that can be downloaded from dev.win- 
dowsphone.com will automatically install the Win- 
dows Phone emulator. After installing the SDK, the 
emulator is available from: 

C:\program files (x86)\ Microsoft XDE\8.0\XDE.exe 
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Figure 1. Comparison of Windows Phone 8 and Windows RT boot loaders 
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You also need a copy of the following tools: 

• Visual Studio or Visual Studio Express - http:// 
www. microsoft com/express/ 

• Windows Phone Power Tools - http://wptools. 
codeplex.com/ 

• I LS py - http://ilspy. net/ 

• Tangerine - https://github.com/andreycha/tan- 
gerine 

Some commercial alternatives for ILSpy and Tan- 
gerine that are worthwhile exploring: 

• X AM L S py - http://xamlspy. com/ 

• .NET Reflector - http://www.reflector.net/ 

Hyper-V configuration settings 

• Windows Phone 8 emulators are Hyper-V vir- 
tual machines each instance having their own 
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Figure 2. l/IZ/ndoi/i/s Hyper-V configuration 
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This virtual machine is configured to use: 
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Memory 

Increasing the memory allocation of the virtual machine can improve performance 
but may aha reduce the performance of other running applications. 
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Figure 3. VMware hypervisor configuration 
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IP addresses. When using an emulator for test- 
ing, a system with core i3, i5 or i7 or equivalent 
AMD processor supporting newer hardware 
visualization features is required. 

• First of all, make sure your hypervisor settings 
are enabled in your system BIOS. Next, vali- 
date that Hyper-V settings are enabled in Win- 
dows. 

VMware configuration 

• It is often advantageous to perform penetration 
tests from a virtualized environment. In order 
to conduct Windows Phone 8 penetration tests 
using VMware, a number of virtualization set- 
tings need to be configured. In VMware Fusion: 

• Enable the VT-x/EPT hypervisor option (Figure 2) 

• Open your .vmx file in a text editor and add the 
following setting (Figure 3), if not already there: 

mce. enable = "TRUE" 

Windows Phone applications 

Windows Phone 8 applications are stored in the 
XAP file format. A XAP file is, similar to an Android 
APK file, a compressed zip archive containing all 
the application's supporting files such as DLL's. 
The AppManifest.xaml file defines the assem- 
blies that get deployed with the client application. 

H Windows 8- xei.vmx 
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- encoding = "UTF-B" 

confio. vers ion = "fl" 

virtudUHW, version = "9" 

hypervisor. c pu id ^6 = "FALSE" 

mce, en a ble = "TRUE'I 

sc 5 iB. present - "TRUE" 

ccGiB.virtualUev = "' LsisaslBtir 

mrcize = ,, 484B"' 

mcfi, hotadd = " [KUf 

ccsiBiB. present = "lRUf 

scsiBiB.riLewame = -virtuaL uiok.vmdk" 

ldel^B. present = , TKJt" 

tdel^B.riletJame - "auto detect"' 

ld^l^e.devlceType - ■'cdrom-raw" 

eihernets.pre&ern: - "TRUE" 

ei hern eta. connectionType - "naf 

et he rnete. virtual Dev - ■"eLaeee"' 

ethernetfi.wak.eOnPckiRcv - '"FALSE" 

eLhur neLfi, dddmiiTyptf = " q t* nu r J L tui" 

v L ha r n e? Lfl , Lin kS I d L«P r op Jtjd Lion . y nub lt» = 

ui b . [3 r e ten L = "'TRUE"' 

yhci, oretBn t = "'TRUE"' 

ot-iSlotNumLer = "JA" 
uib_xl-n.i . ur tfbtjril = "'TRUE" 
smjnr.1. firH'iKn t = '"TR1JF" 
<;.mjncl. vi rTualilpv - "hcfantlin" 
^n-uncl. f i iipNadfi - 



Figure 4. Enable hypervisor support within your virtual 
machine .vmx file 
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1 KB 
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Application Extension 
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,=', ijystem.Windows.Loritrals 


XML Document 
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^ ^yd-pm.Windnrw«.rnn*rok.dll 


Applifishinn Fytpn^inn 


Tl KR 
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XML Docurneril 
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System. Wi rid ows. Control s.Extended ,d 1 1 


Application Extension 


55 KB 



Figure 5. Unencrypted XAP file content 
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Listing 1 . Full PlayDRM header of encrypted XAP file 

<WRMHEADER xmlns="http : / /schemas . microsoft . com/DRM/2007/03/PlayReadyHeader" version="4 .0.0. 0"> 
<DATAXPR0TECTINF0XKEYLEN>1 6</KEYLENXALGID>AESCTR</ALGID></PROTECTINFOXKID>w3i0edJP7EOqQ6aQzdA 
oSQ==</KIDXLA_URL>http: //microsoft. com/</LA_URLXCUSTOMATTRIBUTES xmlns= ><S>9FcV5qmf IsMc+X2MVmX 
3Hw==</SXKGV>0</KGVX/CUSTOMATTRIBUTESXCHECKSUM>Hu3+fizBvKU=</CHECKSUMX/DATA> 
</WRMHEADER> 



This file is updated when compiling an application 
(see Figure 5). 

Whilst publishing an application to the Windows 
Store, Microsoft will encrypt the content and digi- 
tally sign XAP file using PlayDRM. As a result, it's 
not possible to extract the XAP file you download 
from the official app stores. 

The difference between a XAP file from the app 
store and an unencrypted XAP can be inspected 
by opening the XAP file headers in a text editor: 
Figure 6, 7 and Listing 1. 

A limitation of encrypted XAP files download- 
ed from the app store is that they cannot run in 
emulators. When conducting penetration tests of 
a Windows Phone application using emulators 
it is required to obtain the XAP files of the appli- 
cation compiled by the developer, not from the 
Windows Store. 



them on a Micro-SD storage card. Windows 
Phone Power Tools also allows us to side-load 
apps to an emulator on the fly. 
• Some important limitations to keep in mind: 

• Only apps signed with trusted certificates 
will run (on locked phones) 

• Your Windows phone will validate with the 
Windows Phone store that the app on the 
storage card is the latest release 

Application penetration testing 
Local file storage analysis 

Applications have their own individual isolated stor- 
age space. Using Windows Phone Power Tools, we 
can extract and modify local configuration files of our 
Windows Phone application to check for information 
disclosure vulnerabilities or to attempt to tamper with 
configuration data (Figure 8 nad Figure 9). 



Side-loading is the process of installing appli- 
cations on a device without using the official 
app store. Apps can be side-loaded by copying 
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Figure 6. P/Cft/e header of unencrypted XAP file 
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Figure 7. PlayDRM header of encrypted XAP file 
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Figure 8. Side-loading apps in Windows Phone Power Tools 
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Figure 9. Local file system analysis using Windows Phone 
Power Tools 
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Internet Options 
Local Area Network [LAN) Settings 




Proxy Settings 

Servers 

1 . Type Proxy address to use 



Port 



HTTP: hostname 



Secure: hostname 
FTP: hostname 
Socks: : 

@ Use the same proxy server for all protocols 
Exceptions 

Do not use proxy server for addresses beginning with: 



8080 
8080 
8080 



Use semicolons [; ) to separate entries, 



Cancel 



Figure 10. IE proxy configuration settings 



. . .,— 




Figure 1 1 . Analysing network traffic of your WP8 application 
using Burp Proxy 
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Figure 12. Decompiling source code using Tangerine 



Application traffic analysis 

To understand the internals of the application, we 
need to be able to intercept, analyse and modi- 
fy information exchanged between our application 
and the server systems communicated with. Simi- 
lar to when testing web applications, we will use 
our favorite web application proxy software to ac- 
complish this. We need to keep a couple of things 
in mind to be able to accomplish this: 

Since Windows Phone 8 emulators are Hyper- 
V virtual machines having its own IP address. 
Network traffic needs to route from the Hyper-V 
virtual machines through the Hyper-V host (i.e. 
our test machine). As a result, we need to ensure 
our proxy software is configured not to only lis- 
ten on the LOCALHOST interface you would typi- 
cally intercept on whilst assessing regular web 
applications, but explicitly on your HOSTNAME: 
Configure your IE proxy settings to proxy through 
your HOSTNAME, not 127.0.0.1 or LOCALHOST 
(Figure 10). 

A restart of the emulator is required each time 
IE proxy configuration settings are modified as the 
Windows Phone emulator does not update proxy 
settings on the fly. 

The OWASP Mobile Security Project is a good 
starting point outlining what your tests should fo- 
cus on during mobile penetration tests, in addition 
to the tests you typically would conduct on other 
web applications (Figure 11). 

Decompiling applications 

Tangerine is free software that can be used to 
decompile your Windows Phone applications to 
have a closer look at the source code for securi- 
ty vulnerabilities using static and dynamic analy- 
sis. Take note again that to be able to decompile 
the application, the XAP file of the application to 
test needs to be obtained from the developer, 
not from the Windows Store due to the PlayDRM 
encryption. 

XAML Spy ($79, free trial) is a good commercial 
alternative. XAML Spy relies on third party decom- 
pilers; a prerequisite is to have one of the following 
three .NET decompilers installed: 

• ILSPY (free), http://ilspy.net/ 

• JustDecompile (free), http://www.telerik.com/ 
products/decompiler, aspx/ 

• Reflector ($95, free trial) http://www. red-gate, 
com/products/dotnet-development/reflector/ 

Summary 

This concludes the article on Windows Phone 8 
security testing essentials. In summary: 
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Figure 13. Decompiling source code using XAML Spy 
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Black box Windows Phone 8 application pene- 
tration testing can be conducted using a physi- 
cal Windows Phone 8 device but not using em- 
ulators since emulators cannot run XAP files 
downloaded from the Windows Store. 
White box Windows Phone 8 application pene- 
tration tests should be conducted using emula- 
tors: It is only possible to decompile XAP files 
of non-PlayDRM encrypted XAP files. Since 
there's no jailbreak yet for Windows Phone 8, 
analyzing local file storage only appears possi- 
ble at this stage with emulators. 
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Mobile Network Traffic 
Analysis 

Mobile network analysis is the process of capturing network 
traffic and inspecting it closely to determine what is 
happening "under the hood". Monitoring network traffic is 
important in most mobile app penetration testing, yet fun 
to mess around with. 



Nowadays the popularity of mobile app mar- 
kets is higher than that of smart phones. 
It is exceedingly clear that most of the ap- 
ps require internet connection in order to perform 
properly. Since the end user only sees the client 
front end, it is not possible to see the POSTs and 
GETs that the app sends to an external server in 
an easy manner. 

In order to monitor the traffic, 3 rd party software 
must be used to sit in between the device and mo- 
dem, as a proxy. There are many proxies in order 
to carry out this mission such as Fiddler, Paros and 
the Burp suite. In this article the Burp suite was 
chosen as the proxy. Burp suite is a Java based 
software that can be used to record, analyze, test, 
and tamper with traffic. 

Setting up the proxy 

To use the Burp suite as a proxy there is a small con- 
figuration required within the software. Firstly the soft- 
ware can be download from it official website: http:// 
www.poiiswigger.net/burp/download.html, Since the 
Burp suite written in the Java language, Java runtime 
environment is required to run the tool and it can be 
downloaded from Oracle's Sun website: http://www. 
oracle.com/technetwork/java/javase/downloads/in- 
dex.html. 

Additional information about the Burp suite and 
java applets in general can be found here: http:// 



www.portswigger.net/burp/help/suite_gettingstart- 
ed.html. 

After downloading and installing the Java run- 
time environment, we can now run the .jar Burp 
suite in 2 different ways. The first is to run Burp 
directly by double-clicking the Burp JAR file. How- 
ever, it is preferable to launch Burp from the com- 
mand line, as this gives you more control over its 
execution, in particular the amount of memory that 
your computer assigns to Burp. To do this, in your 
command prompt type a command like: 



| &o! P ^ullr Fin- lihtm „ L.^ 




la uu -hi* ore* I 



[frj lnlr-rer-p'1 Clionl Rfq.ir-s.lt 



jam** j 



DmMm i win 



Figure 1 . Burp Suite interface 
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java -jar -Xmxl024m /path/to/burp . j ar 

where 1024 is the amount of memory (in Mb) that 
you want to assign to Burp, and / P ath/to/bur P .jar 
is the location of the Burp JAR file on your com- 
puter. The first screen you see after starting the 
Burp suite is: Figure 1. 

There are many menu tabs and features in the 
Burp suite, but we are not required to use any of 
these in this article as we are using the Burp suite 
just as a proxy, so after proceeding to the Proxy 
tab and the Options, we will be seeing a screen 
like this: Figure 2. 

At the moment of running the Burp suite the 
proxy has been started to intercept traffic by de- 
fault on port 8080 as we can see, but we have to 
change the settings to get the external traffic from 
the network. We need to edit the existing listener 
on the port 8080: after clicking the Edit button we 
must check the 'All interfaces' radio button in order 
to get this work on other devices (Figure 3). 

After this stage the proxy is ready to capture 
all the traffic within the network on the 8080 port, 
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Figure 2. the Proxy tab 
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but the device is not on port 8080 by default, so a 
small change is required on the device to alter the 
proxy setting. 

Along with the target port we need to point the 
device to the machine IP address that is running 
the Burp suite proxy on, so we need to identify the 
machine's IP address first by executing i P confi g 
command in CMD on Windows and ifconfig in 
Linux/UNIX operating systems (Figure 4). 

Now we have identified the IP address as 
192.168.0.5 and the proxy port as 8080, we are 
ready to point the mobile device to the Burp suite 
proxy, this can be done in iPhone and iPad by go- 
ing to the Settings, Network and then change the 
HTTP Proxy to Manual and enter the gathered in- 
formation as shown: Figure 5. 

We have now connected the device to the Burp 
proxy and then to the internet. To test this let's 




Figure 4. Identifying machine's IP address in Windows OS 
HTTP Proxy 



Off 



Manual 



Auto 



Server 



192.168.05 



Port 



8080 



Authentication 



Figure 5. Configuring the device 
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Figure 3. Configuring the proxy 
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Figure 6. £i/rp Si//fe capturing the first session visiting 
google.com.au 
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Figure 7. Bubble Mania communication 



browse the net via the device, if everything has 
been set correctly this should be our first capture 
with the Burp suite: Figure 6. 

Now we are capable of peeking under the hood 
and view any device its communication with the 
internet. This can be very useful when it comes to 
pentesting an app as we can check for: 

• Unprotected communications (SSL and no en- 
cryption ) 

• Insecure file system permissions (Writing pro- 
gram files with poor permission) 

• Exploiting buffer overflows within an app 

• Insecure file system storage (such as storing 
sensitive data by the app; passwords, credit 
cards and keys on an external server 

• Phone identifiers used in authentication 

• Local web vulnerabilities (Tampering data with 
attacking vectors) 

• Unauthorized access to paid-for resources 

In this article we are going to discuss and ana- 
lyze an issue of unprotected communication with- 
in a game, called Bubble Mania which is the most 
popular free game on the app store. 

This is a network traffic capture taken using Burp 
suite when starting a level inside the game: Figure 7. 

Firstly as it can clearly be seen the app using 
HTTP as communications protocol which is not 
safe when dealing with a customer's personal de- 
tails, as this app offers many in-app purchases. 
Secondly if you have played this game you have 
a limited time to play the game each day, five tries 
everyday. This app uses the device's time and 
sends it to the bubbie.teamiava.com server without 
encryption, this allows us to modify the date and 
gain extra tries every time playing this game. 

Other apps behav exactly the same. For exam- 
ple: some apps allow a limited number of charac- 
ters to be typed in their text field using a mobile de- 



vice but when capturing the traffic we can edit the 
text field area and bypass this validation for buffer 
overflow exploitation since all of the iOS apps are 
written in objective C. 

Summary 

As mentioned earlier, mobile phones are devices 
containing various types of personal information. 
As the popularity of these devices and their appli- 
cations increase, so does the interest of the hack- 
ers to find and exploit vulnerabilities in these de- 
vices and apps and acquire data. Their potential 
attacks are aided by the functionality provided by 
the operating system running in the smart phones, 
most of the recent mobile phone application at- 
tacks are done via using only the client side of 
view and most pentesters ignore the network side 
of apps. This article demonstrated the importance 
of capturing and analyzing the traffic on mobile de- 
vices and how this can be useful when pen-testing 
an app. 
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What do you need to know when your kid is using a mobile 
phone 



In this article I will try to explain Mobile Safety. I will not 
go into history of mobiles and communication technology 
cause it is not so important for this topic. 



When mobiles hit the market, we changed 
the way we communicate with each oth- 
er. Today, smartphones have changed 
everything. Now, using a smartphone we can: 

• Shoot videos and images 

• Send and receive e-mails 

• Browse the Web 

• Connect with friends and family 

And much more. 

For businesses or private use, smartphones are 
just so easy and fun to use and still they are pow- 
erful and feature-rich. 

Even better, you can access a hundred of thou- 
sands mobile apps to be installed on kid's phone. 

There are a great and helpful apps for kids that 
should be installed on they mobile phone and they 
are free also. 

Unfortunately, using smartphone can be very 
dangerous too. Smartphones like iPhone are al- 
most like PC. You can do almost everything you 
usually do on your laptop or PC. 

9 of 10 kids use social networks like Facebook 
on their mobile phones which is good to stay con- 
nected with known friends and family but it can be 
dangerous without parent supervision. In today's 
modern world, kids and teenagers are practically 



not accepted as a part of the community by their 
peers if they don't have a smartphone. 

What do you need to know 

• Does mobile phone have Internet access 

• Is Bluetooth disabled 

• Is location services turned off 

Let's try to give a short description: 

Does the phone have internet access? 

All UK mobile phone companies have to provide 
an internet filter on their phones to help block po- 
tentially harmful stuff like pornography. But, and 
this is the important bit for parents, most operators 
don't activate the filter unless you ask them to. 

Is Bluetooth enabled? 

Bluetooth enables your child's mobile phone to 
find and talk to other Bluetooth-enabled mobile 
phones in the vicinity. If it's activated, it means 
your child could receive unexpected and unwant- 
ed messages, and any personal information stored 
on your child's phone - for example, their contact 
list - could be vulnerable. Switching off the Blue- 
tooth option makes the phone 'invisible' to other 
Bluetooth users. 
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Is the phone registered for a child or adult 
user? 

If the phone is registered to a child user, it will auto- 
matically not be able to access content rated 18+. 
But if your child has a phone that has been passed 
down to them from you or another adult, no such 
block will be in place. Brave the piped music and 
endless wait and talk to your mobile phone opera- 
tor to find out if the internet filter is activated. 
Scary stats 

• 52% of nine year olds and 95% of 15 year olds 
have a mobile phone 

• By 2020 most of us will connect to the internet 
via our mobile 

Check whether parental controls are set as de- 
fault on your child's mobile - if not, ask for them to 
be switched on. 

Can the phone access chatrooms or games where 
users chat to one another? 

Are these moderated? Chatrooms provided by 
your child's mobile operator or its partners which 
do not have 18+ age-restrictions must be moderat- 



ed. Find out about the operator's moderation poli- 
cies and systems. Be aware that chatrooms ac- 
cessed on the internet via your child's mobile (ie 
which are not provided by the mobile operator or 
its partners) may not be moderated. 

Is location services' switched off? 

If you agreed to get your child a mobile precisely 
so that you could keep tabs on where they are, 
then you've got to weigh up the pros and cons, 
safety-wise, of your child's phone having location 
services switched on. It's a tricky one - Vodafone 
has a detailed parents' guide on the safety and pri- 
vacy issues raised by location services. 

Essentially, mobile phone location apps aren't nec- 
essarily provided by mobile networks and both GPS 
and WiFi can locate and communicate your child's 
location without their mobile phone operator being 
aware of it. Check the phone's settings, so you know 
where location services are on or off. Alternatively, 
disable the GPS or WiFi on your child's mobile. 

With your teenagers, stress to them that if they use 
a location service alongside their social networking 
profile, eg Facebook, everyone on their 'friends' list 
will know where they are at any time, so that they 




have to be 100% certain they only allow 'real' friends 
who they know and trust to locate them. 

Does your child know that they should never give 
out their mobile number to strangers? 

Our parents told us never to talk to strangers and 
we in turn need to stress to our children that they 
mustn't give away any personal information to 
people they've never met before via their mobile 
and the internet. 

Agree on what features kids can use 

Based on the age and maturity of each child, 
agree on phone features. Define clear rules for 
sensible use and the consequences for break- 
ing them. Talk about usage: who they can talk 
to or text and when, the websites they can visit, 
and so on. With older kids, discuss cyberbullying 
and sexting. 

From time to time, ask your kids to show you what 
is on their phones. Periodically re-examine rules as 
children mature and mobile technologies evolve. 

Teach kids safe and responsible phone use 

Help kids understand the following: 

• Share their phone number only with family and 
close friends. Do not put it on social network 
pages, use it to enter contests, or give it to just 
anyone who asks for it. 

• Lock the phone with a PIN that your child 
keeps secret (even from best friends) to pre- 
vent others from snooping or misusing it. 

• Don't say, text, or post anything that would hurt 
or embarrass someone. 

• Don't make, send, or accept provocative texts, 
photos, or videos. 

• Avoid clicking links in ads, contests, text mes- 
sages (even from friends) offering free prizes 
and the like. 

Get help from technology 

Clearly explain why you are using safety tools and 
what they will do for your children's information se- 
curity. Consider setting them up together. 

Some protections are provided through the car- 
rier's service; others can be set on the mobile 
phone. The most reliable are those on the phone, 
because when a phone uses a wireless network, it 
bypasses the carrier and its tools. 

Filter or block websites and content as appropri- 
ate for your child's age and maturity: 

• Consider blocking Internet access for the 
youngest; for teens, think about restricting ac- 



cess to gambling, adult, and other inappropri- 
ate sites. 

• Filter lyrics, video, and other content that is vio- 
lent or explicit. 

• Restrict access to forums (including in games) 
unless they are moderated by humans. 

Use GPS cautiously. If you use a family location 
service to monitor your kids' whereabouts, make 
sure others cannot locate them. Otherwise, con- 
sider disabling the location feature on your child's 
phone; at the very least, turn it off in the phone's 
camera. 

Manage contacts, which can include blocking 
callers and restricting contact to approved num- 
bers only. 

What to do if there are problems 

Immediately report: 

• Physical threats, persistent cyberbullying, or 
any form of exploitation to the police and the 
carrier. 

• Inappropriate content or behavior to the carrier 
or app. 

5 Apps you can use to keep kids safe 
Sygic Family 

Sygic Family keeps your family safe by allowing 
you to check the real-time location and the bat- 
tery levels of your family members' smartphones. 
You can also track your children's whereabouts, 
or have them check-in periodically to let you know 
where they are and if they have arrived at their 
destination safely. 



C Sygic- 



5 



Family by Sygic 

Figure 1. Family by Sygic 

The app also has an in-built messaging system 
which lets you send messages for free over an In- 
ternet connection. You can also set Safe or Unsafe 
zones - a notification will be sent to you when they 
enter or leave these zones. There is also an SOS 
button available in this app, which lets you send 
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out your exact location at the tap of the button. You 
never know when you might need it. 
Platform: iOS | Android 

Life360 

Life360 has pretty much the same things Sygic has: 
GPS locations of your family members via their 
smartphones, a panic button, and alerts when some 
one enters a preset zone (e.g. gets home). It also lets 
you check where they have been (location history), 
where to get help in an emergency (hospitals, police 
stations), and allows you to have group chats. 




Figure 2. Life360App 

If you don't have a smartphone, you can still use 
this with a mobile phone at RM4.99 per month, for 
up to 5 mobile phones (only in the U.S.). A text 
message will be sent to them and once they con- 
sent to it, their location would be tracked and sent 
back to you. The app tries its best to not be a mon- 
itoring app but more of a communication tool to 
help bring families closer together and safer too. 

Platform: iOS | Android | Blackberry 

mamaBear 

Here is another great app for keeping your chil- 
dren safe; the difference is, it also helps keep your 
child safe online. MamaBear has a feature to keep 
watch over your child's Facebook feed. You will be 
alerted to any signs of bullying or use of crude lan- 
guage as well as when they check-in or get tagged 
on their friends' photos. The team is working on 
doing the same for Twitter and Instagram profiles. 

Offline, you will receive alerts for when they leave 
a place, when they need to be picked up, when 
they are driving or riding past a certain speed limit, 
or when they explicitly need you in an SOS cry for 
help. This app will give you either peace of mind 



or great conversation starters on talking about 
speeding, truancy, open communication channels, 
and how to stay safe at all times. 
Platform: iOS | Android 
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Figure 3. MamaBear App 
Google Latitude 

Google Latitude is less of an app and more of a 
tracking tool. It allows you to see where your family 
members are on a map, and easily keep in touch 
with them. To use it, sign in to Google Latitude and 
start adding your family members via their Gmail 
contacts. When they accept, you can see their lo- 
cations on Google Map on your phone. 
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Figure 4. Google Latitude App 

Their locations will be at the background even 
when the app is closed or when your smartphone 
is locked. Android users have a widget they can 
setup. You can also get the app to check you in au- 
tomatically at a preset place. As this is not restrict- 
ed to family members you can use it to check just 
about anyone's whereabouts, provided they are on 
Google Latitude. 

Platform: iOS | Android 
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MobileKids 

This is the odd one out, but some parents may re- 
quire this level of monitoring for their children. Re- 
ceive alerts when your kids have been using their 
mobile phones in the middle of the night, when they 
add a new unrecognized contact, or when they 
download a new app. Parents will also get statis- 
tics about their children's mobile usage, which they 
can use to set usage limits (premium account). 
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Figure 5. MobileKids App 



My Limits Settings 



LOW 

• Blocks pornography, nudity 
IMPORTANT 

For Net Nanny to be effective, Safari and other web 
browsers should be removed/disabled. To disable 
Safari, go to Settings > General > Restrictions. In 
the same menu, turn off "Installing Apps" to ensure 
other non-filtered browsers are not installed. 

NOTE ABOUT HYPERLINKS 

Browsers other than Safari cannot open when you 
click hyperlinks within emails, texts, or apps. In- 
stead, you must copy the hyperlink URL and paste 
it into Net Nanny. This is a limitation for all third- 
party browsers, not specific to Net Nanny. 

PRODUCT FEATURES 

• Filters Web Content 

• Profanity masking 

• Safe Search enforcement 

• Protection on Wi-Fi, 3G/4G networks 

BROWSER FEATURES 



There is still the much sought-after location fea- 
ture, with a slight twist. The SOS button and Check- 
In feature is in but more interestingly, the child can 
request for their parents to track their movement 
live via GPS tracking, something like remotely 
'walking' them to their destination. 

Platform: iOS | Android 

Net Nanny Mobile Safety 

Great iOS app for kids: 

Net Nanny is a customizable safe Internet brows- 
er - intended to replace the Safari browser. Use a 
world-class Internet filter from the market leader. 

Choose from 3 Safety Settings: 

HIGH 

• Blocks pornography, nudity, death, gore, abor- 
tion, mature, lingerie, swimsuits 

• Masks profanity 

MEDIUM 

• Blocks pornography, nudity 

• Warns for death, gore, abortion, mature, linge- 
rie, swimsuits 

• Masks profanity 



Cut and Paste 
Pinch and Zoom 
Landscape Mode 
Multiple Tabs 
Bookmarks 

URL browsing history and suggestions 
Persistent Cookies 

Alternative Search with Google, Yahoo!, Bing 



DALIBOR VLAHO 

JJg Dalibor Vlaho, born in 1985, in town 
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When is a Tablet safer 
than PC? 

Magicians have just one tool for all their plans: Abrakidabra! 
Despite the security admins whos every day game is to 
"compare" various settings and equipment, and "select" 
the securest ones. In this article we discuss when choosing 
a tablet is safer than a PC and how this device helps us to 
upgrade our organizational security. 



It is said that tablets and smartphones are not 
smart enough in security and since vulnerabili- 
ties rely on "security stupidity", it is judged that 
these new born appliances are not safe to use. 
The judgment has become so bold that recently 
some organizations preferred NOT to use smart- 
phones and tablets. The question is: "are laptops 
always safer than smartphones and tablets?" The 
answer is No! 

In this article we discuss about how a smart- 
phone or tablet can be safer than a laptop or desk- 
top computer. For shortening in writing, until it is 
not specifically mentioned we use the term Tablet 
generally addressing smartphones, palm pc, tab- 
lets and as the like in this category although there 
are differences in functionality and security. 

Main Security Advantages 
Safer Internet Network 

Certain methods of data capturing and sniffing are 
based on LAN and traditional computer networks. 
For instance methods such as MAC Spoofing or 
Arp Poisoning are effective on a connected net- 
work, or methods like DNS poisoning works if the 
hacker can alter the DNS configuration of the vic- 
tim which is really hard to do in a tablet using its 
own mobile data. In other word, while the user is 
not using the wired or wireless internet access it's 
instead using the mobile data. Since techniques 



for MITM or other usual sniffing methods are very 
hard to perform on mobile data infrastructure, 
therefore in some cases it is safer to use a tablet 
rather than a pc or laptop. 

For instance, to check bank account with the ap- 
plication supplied by the bank on a tablet is much 
safer than opening the website of the bank on the 
laptop which is connected to a LAN with hundreds 
of computers especially in a guest network. 

The prepared Mobile Data access on tablets can 
create an isolated internet access for certain pur- 
poses which such an isolation would be very hard 
to be designed amongst the LAN. 

More secure in the nature 

In the first days when the primitive computers 
came into existence, nobody could even imag- 
ine that one day there would be a software which 
can harm the computer itself and there would be 
specialists who intentionally create these harmful 
applications. This means that the term "Security" 
was added to the IT dictionary long after the Op- 
erating Systems had started to work publicly. The 
computers and features of them grew much fast- 
er than the security systems and such different 
growth rate has caused a big gap between func- 
tionality and security, a gap that is still is a cozy 
safe house for vulnerabilities, security breaches 
and hackers of course! 
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However the cellphone manufacturers made 
the first smartphones in 2000, although the first 
real smart one came to the market in 2004. Con- 
sidering the manufacturing year of first iPad 
which is 2010, we can come to the conclusion 
that when the smartphones and tablets were be- 
ing designed, designers had deeper and more ex- 
perienced knowledge about security. Hence the 
tablets platform and infrastructure are based with 
more security considerations. In other word, se- 
curity has been present in their designing process 
from very scratch. 

SIM Card base design 

To be SIM card based is another advantage of 
tablets. SIM card brings the benefits of privacy 
and security along with trust functionality. Cur- 
rently the SIM card security, is one of the most se- 
cure and trustful technologies in the world. Nowa- 
days when the strongest encryption and security 
methods are needed, SIM card comes into the 
picture first. 

Another security benefit is that a digital signa- 
ture generated base on the SIM card can be used 
for assuring the integrity. This signature is different 
from the popular signatures we use for SSL and is 
inserted in the presentation layer of the OSI and 
therefore brings higher and stronger levels of se- 
curity (Ref.: 'The SIM card as an Enabler for Secu- 
rity, Privacy, and Trust in Mobile Services" Carsten 
RUST, Stefano SALSANO, Lars SCHNAKE). 

The point is that although laptops can use a SIM 
card as well as mobiles and tablets, however mo- 
bile is solely manufactured based on the SIM card. 
The Operating System and even the hardware of a 
tablet and smartphone design is involved in work- 
ing by a SIM card and the SIM security roles on 
very low levels of the system. 

The other benefit of SIM card based functional- 
ity is the uniqueness of a SIM card. Replicating 
a SIM card is almost impossible while replicating 
the MAC address as one of the most unique IDs of 
network can be done in a glance! Hence by using 
a tablet or smartphone as a SIM card based de- 
vice, we can secure the network by getting much 
closer to confidentiality and authenticity (in the se- 
curity triangle). 

Fewer Malwares 

Currently there are roughly 24,000,000 virus sig- 
natures for known viruses, just known viruses! A 
small portion of these are related to mobile virus- 
es and especially the known viruses for tablets 
and mobiles are not so very strong and destruc- 
tive yet and still we haven't experienced serious 



events such as viruses like Chernobil and Stux- 
net. In additions there are numerous polymor- 
phic and metamorphic computer viruses which 
exist in the world and change every now and 
then and occasionally we see various versions 
of them. 

In addition to the fact that the number of virus- 
es written dedicatedly for tablets are very low, we 
have good news that those detected tablet virus- 
es nowadays are not effectively a real virus. In 
terminology, a worm is an unwanted application 
which can distribute itself from one client to an- 
other host automatically, a virus requires the user 
interaction. However for tablets, since the com- 
munication over the network and especially from 
one tablet to another tablet is strictly controlled by 
the OS and is not as smooth like in computers, 
the "distribution rate" of mobile malwares are dra- 
matically slower. 

Generally speaking most of tablet malwares 
are rather a Trojan Horse than a real distributive 
worm or virus and until the user dose not trust 
any third party application and dose not install 
them at all, the presence probability of malwares 
on his or her tablet would be reduced close to 
zero percent. 

Furthermore, many computer viruses rely on 
vulnerabilities and act by leveraging intrusion at- 
tacks. Although tablets can be vulnerable to intru- 
sions, however it is not reported yet that a serious 
and successful intrusion attack has occurred and 
is distributing from tablet to tablet! In contrast this 
report is very common in computers like stuxnet, 
Duqu, Confiker and as the like. 

Overall we can say due to the low number of ex- 
isting malwares for tablets and smartphones, we 
can be safer while surfing the internet, working 
with unknown files, and doing such activities. 

Other Security Benefits of Tablets 
Pocket sized 

Amongst portable computer devices, the number 
of stolen laptops is bigger than tablets since they 
are handier to carry and smartphones of course 
can be preserved in the pocket. 

Internal Memory 

Data resided in the hard disk drive of a laptop is 
safe guarded by the applications and OS, while 
they are present! By detaching the hard disk and 
connecting it to another computer as slave, all 
the security applications would be inactive and 
then it is much easier to crack into the hard disk 
data. However, typically the data of a tablet and 
internal memory of a smartphone is not accessi- 
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ble without the tablet itself, and some simple con- 
figuration can be set to wipe the data after couple 
of try and error for infiltration. 

The size of tablets is a considerable advantage 
in physical security. 

Simpler applications 

Tablets' applications are generally simpler. Obvi- 
ously the simplicity is the first rule of security. Fur- 
thermore while the applications are simpler, there 
would be less vulnerabilities in them and of course 
there would be less security breaches. 

Wiper and Tracker 

Nowadays by default many tablets are equipped 
to wiper and tracker features. Using this feature 
we can be sure if by any reason the tablet is lost 
or stolen, there is a way to find the device or even 
erase all the data in it. 

Let's see of what could be found on a stolen tab- 
let from a sales manager: 

• access to his mailbox, since the username 
and password is saved on it, and access to the 
customer list and latest prices which are at- 
tached to the sent emails! 

• the phone book, of all customers and. . . 

• confidential data such as maps or technologies 
or other valuable assets (I had a customer who 
had lost four maps of a product with overall 
cost of $500,000 and after a month their com- 
petitor start manufacturing the same product 
and broke their monopoly. They were all stolen 
from a lost laptop) 

• lots of confidential data such as pictures, SMS, 
banking information,... 

• and so on...! 

In such a case, the owner can easily track the 
device and if found out it is not recoverable 
sends an SMS command to wipe the whole da- 
ta. Even if it was not feasible to send the com- 
mand, the phone can be configured to wipe 
the whole data after five continues wrong 
unlock passkey. 

Tablets vs. General Threats 

There is a rule: "If a hacker wants to get inside your 
system, he/she will and there is nothing you can 
do about it. The only thing you can do is to make 
it harder and longer to get in". However, there are 
some general methods which by applying them on 
the network we can prevent significant amount of 
attacks and security breaches. The reason is that 
there are certain attack methods which are more 



common due to applicability and the rest of hack- 
ing techniques are practical and feasible in very 
special situations. 

Below we talk about some of the common hack- 
ing methods and why using a tablet can protect our 
data and network against them. 

Trojans and Backdoors 

One of the easiest and most effective methods of 
hacking a system or a network, is by sending a 
Trojan to a computer to collect and forward sensi- 
tive data of the victim or open a Backdoor for fur- 
ther abuse. This technique not only is a used by 
hackers, but also is a common method of many 
malwares crawling around the internet. 

Base on the different functionality of Trojans and 
Backdoors, a tablet resist against each in a differ- 
ent behavior: 

Trojans 

Trojans are harmful applications which usually 
contain an entertaining or useful section, and a 
harmful and destructive section which resides be- 
hind it. The point about a Trojan is that this mal- 
ware functions only "on demand", meaning that it 
should be activated and run by the user. Hence 
if the user dose not run or install any sort of third 
party application at all, we can say that the user 
will never become a victim of a Trojan. What is 
important about the tablet applications in the mar- 
ket is that thanks to the factory preinstalled ap- 
plications, tablets can survive usable without any 
other application at all! 

Backdoors 

Backdoors have two segments: Server and Cli- 
ent. The client resides on the hacker system. The 
hacker then puts the server segment on the victim 
host, then the server opens a port and starts listen- 
ing to it. Communicating to that port by the client 
application, hacker sends command to the victim 
host and receives data from it. 

What is important is that these sort of applica- 
tions are mostly prepared packages ready to use, 
and of course they are made base on computer 
operating systems such as Microsoft Windows or 
Linux. Until now, researches haven't shown any 
existence evidence for such a malware for tablets 
and mobile devices. 

Additionally, controlling network traffic on tablets 
are much easier than computers, especially an un- 
wanted transaction can be detected and terminat- 
ed faster and easier. 

Therefore using a tablet is a proper defensive 
method against backdoors as well as Trojans. 
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MAC Spoofing and Arp Poisoning 

For sniffing and data capturing, two of the most 
effective methods are MAC Spoofing and ARP 
Poisoning. ARP Poisoning is used to redirect the 
data between two hosts to pass through another 
host which is the hacker system so that the hack- 
er can see and read the sent and received data. 
This methodology is called as "man in the middle 
(MITM)". In the MAC Spoofing, the hacker imitates 
an already captured MAC address of a system as 
its own MAC address and therefore his system 
would be in place of the victim host. 

Both the above methods resides on LAN access 
and work on one broadcast domain. There are dif- 
ferent defensive methods against data sniffing, 
however the final solution is to isolate and sepa- 
rate the data from the public network. When the 
isolation is the matter, we usually plan a separate 
wireless access point, separate switches or VLAN, 
separate cabling, separate ISP, and internet link 
and so on. However using a tablet with a mobile 
operator data plan will avail us all the foregoing 
situation already prepared and of course with less 
administration headache. 

Note that this solution works fine when the pur- 
pose of internet usage is working with specific ap- 
plications or surfing private and secure internet, 
and shouldn't become a secondary risk point. 

Exploit and Intrusion 

Most of applications are published containing sev- 
eral bugs although companies try to avoid them. 
Due to lack of knowledge or developers' mistakes 
or many other reasons bugs remain in an appli- 
cation and cause it behaves irregular and act un- 
wantedly in an especial circumstance. For in- 
stance allow a user level request to perform with 
administrative level privilege so that an ordinary 
user creates a system level service! In the most 
dramatic result a bug may allow a hacker to run ar- 
bitrary code (run a custom command whatsoever) 
or maybe crashes the application. 

The good news about tablets is that there are 
fewer running applications in memory and it is not 
very common that the user keeps an application 
always running. Furthermore the number of ac- 
tive system services in a tablet is much less than 
a computer. 

Overall we can say a tablet is less engaged with 
numerous applications and services and therefore 
is less exposed to vulnerabilities and exploits. 

Web browsers vulnerabilities 

One of the most popular applications used in all 
the computers is the web browser. A web browser 



is nothing other than an application which sends 
and receives traffic of internet web sites. There- 
fore amongst all the applications on a computer, 
the web browser is the most exposed applica- 
tion to the internet traffic. Hence any vulnerabil- 
ity or weakness in this application is a significant 
exposure to the threats. The bad news is that 
none of the current web browsers in the marked 
is bug-free. 

Compared to computer web browsers, tablet web 
browsers are quite lighter and smaller and they are 
not as versatile as the computer web browsers. Al- 
though this sounds like a disadvantage, however 
due to shorter codes and fewer number of fea- 
tures, bug occurrence and therefore vulnerability 
occurrence is less probable. 

Security Strategies 

There are two popular security strategies which 
are usually used as the security guidelines when 
making any decision about the network: 

• layered security strategy, 

• end to end security strategy. 

In this section we discuss about each of the strat- 
egies and see how we can meet the guideline by 
using a tablet instead of a PC. 

Layered Security Strategy 

In Layered Security scenario -in a practical view- 
we divide the network to several layers of access 
or risk. Then, for each layer we create a security 
layer or security circle to protect that portion of the 
network. Sometimes in this method the portions 
and divisions are mistaken by the security tech- 
niques or features such as the Antivirus, IPS or 
Firewall and so on. The Layered Security method- 
ology, however, divides the whole network to sev- 
eral points of risk such as below: 

• Physical Security 

• Network Security 

• Host Security 

• Application Security 

• Data Security 

These are just examples for the network por- 
tions and risk circles in the layered security 
plan. Each organization may have its own plan 
and there is no certain predefined methodolo- 
gy to be deployed on a network. Since the Lay- 
ered Security is a complex and expensive meth- 
od, this method is not very popular amongst the 
security designers. 
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After defining the segments, we assign security 
teams to manage the security of one or more seg- 
ments and we decide what sort of equipment, hard- 
ware or software should be used in the segments. 
The steps which we decide whether a tablet can 
raise the security level of the segments or not. 

Below we discuss when to choose a tablet in 
each layer of security: 

Physical security 

It is easier to protect a tablet from thieves. If physi- 
cal access is a concern, a tablet and especially a 
smartphone can be a good choice. As mentioned 
before, wiping the data of a tablet is quick and 
easy, and since this device can be kept in pocket 
we won't have to remind the client every day that: 
"lock you system when you leave it!" 

Network Security 

When the data leaves the host, we have no more 
control over it, so it is vital to be sure that they go 
out in a correct path, toward correct destination 
and of course reach the destination intact. Some- 
times instead of securing the network in order to 
make it a safe place, it is easier to change the net- 
work from a public network to a private one. If this 
method helps, swaping the PC with a tablet for cer- 
tain tasks would be wise. 

Host Security 

Generally speaking, any entity in a network which 
can send and receive data is called a host. One 
group of hosts are Endpoint Systems such as PCs, 
Laptops and if chosen, Tablets. In most cases, a 
tablet performance is not sufficient for all the cli- 
ent needs, however tablet can be a workaround for 
many complicated security scenarios which cost a 
lot to deploy or in some cases the best solution. 

Application Security 

Patch management, updates, upgrades, check- 
ing certificates and trustability of third party appli- 
cations is a part of controlling the application se- 
curity. Additionally resolution of the changes and 
probable conflicts is another duty in this security 
section. Although the security administrators try 
to tune it up to the highest security levels, none- 
theless sometimes keeping an application and 
its transactions secured relies on isolation and/or 
simplicity. In this case choosing a tablet would be 
a significant help. 

Data Security 

Protecting the data means to have control on 
where they are cumulated, where they are sent, 



and who from where has access to them. The da- 
ta are usually collected on servers on shared re- 
sources, and on the clients' computers as a private 
resource. Sometimes users share their private da- 
ta with other users which such private resources 
become another publicly shared resource. 

Nowadays although new features of the tablets 
allow the users to share their data on their tablets, 
however tablets and especially the smartphones 
are rather a private appliance and from base they 
are made to be private and isolated. Followed by 
the built-in countermeasure capabilities in these 
devices, protecting some critical data on a tablet 
looks much easier and safer than a PC or espe- 
cially a laptop. 

End to End Security Strategy 

In the End to End security strategy, at the first step 
all the gates which the data step into the network 
as one end, and the points in which data termi- 
nates as the other end, should be listed and cat- 
egorized separately. This categorization can be 
based on the use or functionality. Commonly the 
two main ends in the networks are the internet 
gateway as the front end and the client computers 
as the endpoint. 

Base on the needed security level, we should se- 
lect proper solutions along with suitable equipment 
for that category. Deciding between a Tablet as the 
endpoint system or a PC and Laptop should be 
made in this section. 

In order to protect an endpoint computer, we need 
to apply various security considerations which be- 
low is some examples: 

• Antivirus 

• Firewall 

• IPS 

• Physical security 

• Internet Security 

By changing the endpoint host from a pc or laptop 
to a tablet, since the hardware and especially the 
OS changes, we may be more secure depend on 
the situation. 

Antivirus 

As explained before, there are less viruses for tab- 
lets and compared to the computer viruses they 
are considerably less destructive. Benefiting from 
this advantage, instead of a laptop we can use a 
tablet to be on a safer side. In addition, antiviruses 
for tablets are not as complicated as for desktops 
and need less management to work best. Hence 
just installing an antivirus for a tablet can reassure 
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us a bit more that it will work properly! By the way 
most of the managed and enterprise antiviruses 
nowadays can control and monitor client applica- 
tions installed on tablets and smartphones as well 
as desktop computers. 

Firewall 

A firewall task is to block unwanted ports and just 
allow transactions from defined known ports. The 
reason for using a firewall is that backdoors most 
of the time use irregular ports for transacting to the 
hacker and benefiting from a firewall will certainly 
block any similar harmful traffic. 

However since applications on tablets work 
much more isolated than a pc, and whereas ac- 
cessing data and files by an application on a 
tablet needs more permissions from the user, to 
have a firewall on a tablet is not as necessary 
as on a desktop computer or laptop. Note that to 
have a firewall on a tablet is of course a neces- 
sity however the absence of it will harm the tablet 
less than a computer. 

IPS 

Intrusion is a sort of attack which exploits a vul- 
nerability in an application and can escalate its 
privilege to execute a command or cause a crash. 
However as mentioned before in this article, there 
are less known vulnerabilities in tablet's applica- 
tions and therefore to use a tablet would protect us 
against these sorts of attacks. 

In addition, there are much more built-in applica- 
tions on a tablet which we can work with it without 
so many applications like we have on our comput- 
ers. Obviously less applications means less vul- 
nerabilities and of course more security. 

Physical security 

It is said that: "When there is physical access, 
there is no security". Of course there are many 
solutions and techniques to keep a laptop or com- 
puter safe when it is stolen or there is an unauthor- 
ized access to it. However there are some built-in 
security features to protect a tablet against un- 
authorized access and the size of most of smart- 
phones is definitely a considerable advantage in 
physical security. 

Internet Security 

It is important to have a tough security plan while 
surfing the internet. In an endpoint host, it is nec- 
essary to define for what purpose the client will 
access the internet and per the need allow the us- 
er to surf the internet and define an absolute se- 
curity guideline base on it. There are cases that it 



is a real risk to flow the user's internet traffic over 
the intranet, or we are worried about the potential 
risks in a computer or overall we need an isolated 
internet access for a certain user. In addition to 
all these reason we can add the vulnerabilities in 
the computer web browsers which in a computer, 
may lead to a sever security breaches. Consid- 
ering all these, we may judge that a tablet would 
make a safer environment for user's internet surf- 
ing. Moreover sometimes we need a separated 
internet access for a particular application and 
not all the internet surfing. In this case, slower but 
safer mobile internet for just an account checking 
is more beneficial than a fast public internet which 
brings lots of security concerns. 

Conclusion 

There is no final solution for security and no securi- 
ty scenario can be definitely more secure than oth- 
ers. However, a good security consultant always 
have a good collection of various answers for vari- 
ous conditions. 

Tablets and smartphones as new populated de- 
vices, have first stepped in the market as Gadget 
devices but recently they are dramatically devel- 
oped and upgraded so that they can be used for 
business and office use. These devices are in- 
vented when the IT industry had suffered enough 
from security ignorance and hackers attacks, so 
that they are equipped with outstanding security 
features. 

Due to the capabilities and special environmental 
conditions they have, in some cases they can be a 
good choice to be a good substitute for a desktop 
computer or a laptop. 
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INTERVIEW 



Interview with 
Akinfe Oluwafemi 




Is the President of Iris Computer Solutions, 
which specializes in the provision of various 
IT services ranging from Networking and 
Security to Software development. He has 
over 1 0 years of practical IT experience and 
holds a degree from the prestigious Federal 
University of Technology, Akure. He has 5 
certifications; CCNA, CCNA Security, CEH, 
ECSA and A+ ITTechnician. He has a 

passion for innovation in the 
Networking and Network 
Security Space. He is 
also an IT infrastructure 
support Professional. 
He can be found 
online at the following 
sites: http://www. 
iriscomputersolutions. 
com/ and 

http://247infotech. 
wordpress.com/. 



Could you please introduce yourself 
briefly? 

Akinfe Oluwafemi G., the President of Iris Com- 
puter Solutions soon to be known as Roche Con- 
sulting Nigeria, which specializes in the provision 
of various IT and consulting services ranging from 
Networking and Security to Software develop- 
ment. I have over 10 years of IT experience and 
hold a degree from the prestigious Federal Univer- 



sity of Technology. I have 5 certifications; CCNA, 
CCNA Security, CEH, ECSA and A+ ITTechnician. 
I have a passion for innovation in the Networking 
and Network Security Space. I am also an IT in- 
frastructure Professional. I also do some form of 
blogging at http://247infotech.wordpress.com/. I 
love technology writing and music. I love nature 
and traveling... What else can I say about me apart 
from my unique management style. 
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Present your company and yourself within 
its structures. 

Firstly, I would like to say that I operate Iris Com- 
puter solution with partners and we are soon to 
make a big transition into a full services and con- 
sulting firm which will be referred to as Roche Con- 
sulting with a renewed vigour and culture that will 
transform the face of IT business and consulting in 
Nigeria. The Transformation process has begun... 
Watch out! 

Now to the question. Iris Computer Solutions 
(Soon to be known as Roche Consulting Ng) is an 
IT service delivery firm. I am responsible for the 
daily technical operations of the firm, supervising 
processes from IT Project commencement to com- 
missioning and support. Projects ranging from IT 
Infrastructure Management, Application Design 
and Implementation, Security, IT risk management 
and Technical Support Services. 

What does your company deal with? 
We service a variety of customers ranging from 
SMEs to Multi-nationals. We are essentially into 
automation using IT platforms as a tool to drive our 
customer's business for maximum benefit in terms 
of value addition. We also provide IT Security Ser- 
vices. This is the summary of what we do. 

Describe the team you work with. 
We have a team of IT professionals with several 
years of experience in Applications Development, 
Security and Risk management, Service Manage- 
ment, Hardware and Software, Ethical Hackers 
and IT Security Professionals, Engineers, Project 
Managers and Accountants. All our staff are cus- 
tomer centered. We believe that customer is a 
KING and treat them as such. Every member of 
the team is committed to put a smile on the face of 
our customers at first experience - we know that 
there may not be a second chance. 

What services do you provide? 
We provide E-commerce Services, IT Security 
Training, IT Risk Management and Policy devel- 
opment, Vulnerability testing and Management, 
Applications Development and testing, ERP solu- 
tions (Hospitals, FMCG, Hospitality Orgs etc.), IT 
Consultancy services for Government Agencies 
and Multinationals, IT Project Management and IT 
Technical Support Services. 

What are your target clients? 
We provide services for SMEs, Government agen- 
cies, Banking, oil and Gas, MNCs, FMCGs and 
Private Organisations. 



Do you look for new employees? If so, 
What kind of candidates do you look for? 
Yes we do. We are constantly repositioning our 
workforce to meet Human Resource demands. 
Our ideal candidate must be passionate about 
customer service. The techies must be profession- 
ally sound, innovative and solutions driven. People 
who can think outside the box and take the orga- 
nization to the dream heights of success... we call 
this innovative ideas. 

What distinguishes you from other 
companies? 

I will say we stand out in two things. Our passion 
for creating a customer experience that is positive- 
ly unmatched in the market and our unparalleled 
innovative products and services that can be jaw- 
dropping most times. 

What do you think about Hakin9 
Magazine and its readers? 
Hackin9 Magazine overall is a good read for any 
in the IT security space. The offensive must be un- 
derstood before the defensive can be put in place. 
This is what I call "Proactive Security". Hackin9 
Magazine helps you understand the offensive and 
advices good defensive options also. A good read 
indeed for security newbies and professionals. 

What message would you convey to our 
readers? 

Discard the norm of reactive security and open up 
to the concept of Proactive security. This is the key 
to success within the security space. Keep sub- 
scribing to and reading Hackin9 Magazine. 

by Julia Adamczewska 
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INTERVIEW 



Interview with 
Dalibor Vlaho 




Could you please introduce yourself 
briefly? 

My name is Dalibor Vlaho and I am 28 years old 
Security Engineer from Croatia. 

I am current director of ISA - Information Se- 
curity Agency and I'm working for Abu Dhabi And 
Dubai corporations. 

In the year 2008 I founded ISA - Information Se- 
curity Agency that consists of more then 7 000 En- 



gineers Worldwide. Some of the biggest things I've 
done was decrypting message sent from Al-Qaeda. 

I constantly fight against terrorism and Online 
child abuse and any other Online crime act. 

I was a part of a team who hunted down well- 
known online child abusers and reported them to 
the FBI. 

In 2013, I developed high quality Online Child 
Safety Education and Abuse-Prevention Program. 
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Present your company and yourself within 
its structures. 

For more than 5 years, ISA has existed to provide 
valuable intelligence to world's largest government 
and non-government organizations. 

Today, ISA is the country's top technology agen- 
cy, as well as the world's largest employer of com- 
puter security experts world-wide. 

ISA was in completely secrecy but in 2013 it be- 
came publicly known. 

What does your company deal with? 
ISA deals with terrorism and criminals who use 
computer and telecommunication technology to 
harm and steal sensitive information from Govern- 
ments and other Organizations. 

Describe the team you work with. 
Team I work with is a group of highly trained secu- 
rity professionals from all around the world. 

They are present in more than 75 countries and 
they are playing a big role in the ISA. 

What services do you provide? 

• Penetration Testing 

• Web Application Security 

• High Quality Training 

• Facility Security 

• Background Check 

And many more 

What are your target clients? 

• Government 

• Non-government Organizations 

• Large Corporations 

• Medium Businesses 

Do you look for new employees? If so, 
What kind of candidates do you look for? 

We are always looking to hire new engineers but 
as for now we have enough employees. 

What distinguishes you from other 
companies? 

ISA is completely different and can't be compared 
with other agencies. 

Why? ISA started as a secret organization with 
more than 7 000 engineers working for the ISA. 

ISA's role is to monitor network traffic and search 
for malicious users. 

When we do our work, we report it to the FBI and 
take steps to hunt them down. 




There is no building, there is no office - We are 
present in the whole world to protect nations from 
criminals and terrorism. 

What do you think about Hakin9 
Magazine and its readers? 
Hakin9 Magazine is far better than other magazine 
we can find on the market. 

It is based on Step-by-Step tutorials that are very 
helpful and interesting for those who try to under- 
stand how things work. 

I really enjoy reading it and writing for it. 

Hakin9 should be the choice number one for any 
of the IT Experts. 

What message would you convey to our 
readers? 

Now at the age of 28, I have 15 years of experi- 
ence in development and information security. 

At the beginning of my career it was not so hard 
to learn new things. But spending sometimes more 
than 12 hours a day on it was hard. 

Internet was the first place for me to find answers 
to my questions. Unfortunately, in my country (Cro- 
atia) there are not so many guys who can help you 
in learning so I was on my own in that time. 

Now I am experienced and skilled enough to 
teach others how stuff works and I am able to con- 
duct operations that I was not able to do before. 

Use your head and your fingers to grow your 
knowledge and put it on higher level. 

Spread your word and help other to gain more 
skills because good hackers are always welcome 
to the community. 

Use your skills for good things, don't do anything 
stupid and remember ... 

There is no exploit to get you out of the jail! 

by Julia Adamczewska 
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A Cyber criminal can target and breach 
your organization's perimeter in less than 
a second from anywhere in the world ... 

Are You Prepared? 

AIMRC delivers advanced cyber security training, consulting, and development services 
that provide our customers with peace of mind in an often confusing cyber security environment. 
ANRC's advanced security training program utilizes an intensive hands-on laboratory method 
of training taught by subject matter experts to provide Information Security professionals with 
the knowledge and skills necessary to defend against today's cyber-attacks and tomorrow's 
emerging threats. 

ANRC's consulting and development services leverage team member knowledge and experience 
gained in the trenches while securing critical networks in the U.S. Department of Defense and 
large U.S, corporations, ANRC tailors these services to deliver computer security solutions specific 
to the needs of the customer's operational environment. Our approach emphasizes a close relationship 
with our clients as an integral part of our service, We believe we're all in the security battle together, 
and we view our customers as key members of our team in the fight, 
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A BZ Media Event 



Big Data gets real 
at Big Data TechCon! 

Discover how to master Big Data from real-world practitioners - instructors 
who work in the trenches and can teach you from real-world experience! 



Come to Big Data TechCon to learn the best ways to: 



• Collect, sort and store massive quantities 
of structured and unstructured data 

• Process real-time data pouring into 
your organization 

• Master Big Data tools and technologies 
like Hadoop, Map/Reduce, NoSQL 
databases, and more 




• Learn HOW TO integrate data-collection 
technologies with analysis and 
business-analysis tools to produce 
the kind of workable information 
and reports your organization needs 

Understand HOW TO leverage Big Data 
to help your organization today 



"Big Data TechCon is loaded with great networking 
opportunities and has a good mix of classes with technical 
depth, as well as overviews. It's a good, technically-focused 
conference for developers." 

— Kim Palko, Principal Product Manager, Red Hat 

"Big Data TechCon is great for beginners as well as 
advanced Big Data practitioners. It's a great conference!" 

— Ryan Wood, Software Systems Analyst, Government of Canada 

"If you're in or about to get into Big Data, this is the 
conference to go to." 

—Jimmy Chung, Manager, Reports Development, Avectra 
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The HOW-TO conference for Big Data and IT professionals 





Big Data TechCon™ is a trademark of BZ Media LLC. 



